linux-kernel - Re: [PATCH v4 4/4] drm/bridge: imx8qxp-pixel-link: get/put the next bridge

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <e2536229-f8d9-4d65-8211-cf445677bef2@nxp.com>
Date: Mon, 26 Jan 2026 16:06:29 +0800
From: Liu Ying <victor.liu@....com>
To: Luca Ceresoli <luca.ceresoli@...tlin.com>,
 Andrzej Hajda <andrzej.hajda@...el.com>,
 Neil Armstrong <neil.armstrong@...aro.org>, Robert Foss <rfoss@...nel.org>,
 Laurent Pinchart <Laurent.pinchart@...asonboard.com>,
 Jonas Karlman <jonas@...boo.se>, Jernej Skrabec <jernej.skrabec@...il.com>,
 Maarten Lankhorst <maarten.lankhorst@...ux.intel.com>,
 Maxime Ripard <mripard@...nel.org>, Thomas Zimmermann <tzimmermann@...e.de>,
 David Airlie <airlied@...il.com>, Simona Vetter <simona@...ll.ch>,
 Shawn Guo <shawnguo@...nel.org>, Sascha Hauer <s.hauer@...gutronix.de>,
 Pengutronix Kernel Team <kernel@...gutronix.de>,
 Fabio Estevam <festevam@...il.com>
Cc: Hui Pu <Hui.Pu@...ealthcare.com>,
 Thomas Petazzoni <thomas.petazzoni@...tlin.com>,
 dri-devel@...ts.freedesktop.org, imx@...ts.linux.dev,
 linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v4 4/4] drm/bridge: imx8qxp-pixel-link: get/put the next
 bridge

Hi Luca,

On Wed, Jan 07, 2026 at 10:56:29AM +0100, Luca Ceresoli wrote:
> This driver obtains a bridge pointer from of_drm_find_bridge() in the probe
> function and stores it until driver removal. of_drm_find_bridge() is
> deprecated. Move to of_drm_find_and_get_bridge() for the bridge to be
> refcounted and use bridge->next_bridge to put the reference on
> deallocation.
> 
> This needs to be handled in various steps:
> 
>  * the bridge returned of_drm_get_bridge() is stored in the local temporary
>    variable next_bridge whose scope is the for loop, so a cleanup action is
>    enough
>  * the value of next_bridge is copied into selected_bridge, potentially
>    more than once, so a cleanup action at function scope plus a
>    drm_bridge_put() in case of reassignment are enough
>  * on successful return selected_bridge is stored in bridge->next_bridge,
>    which ensures it is put when the bridge is deallocated
> 
> Reviewed-by: Maxime Ripard <mripard@...nel.org>
> Signed-off-by: Luca Ceresoli <luca.ceresoli@...tlin.com>
> ---
>  drivers/gpu/drm/bridge/imx/imx8qxp-pixel-link.c | 16 +++++++++-------
>  1 file changed, 9 insertions(+), 7 deletions(-)
> 
> diff --git a/drivers/gpu/drm/bridge/imx/imx8qxp-pixel-link.c b/drivers/gpu/drm/bridge/imx/imx8qxp-pixel-link.c
> index 91e4f4d55469..b3050310a7f0 100644
> --- a/drivers/gpu/drm/bridge/imx/imx8qxp-pixel-link.c
> +++ b/drivers/gpu/drm/bridge/imx/imx8qxp-pixel-link.c
> @@ -23,7 +23,6 @@
>  
>  struct imx8qxp_pixel_link {
>  	struct drm_bridge bridge;
> -	struct drm_bridge *next_bridge;
>  	struct device *dev;
>  	struct imx_sc_ipc *ipc_handle;
>  	u8 stream_id;
> @@ -140,7 +139,7 @@ static int imx8qxp_pixel_link_bridge_attach(struct drm_bridge *bridge,
>  	}
>  
>  	return drm_bridge_attach(encoder,
> -				 pl->next_bridge, bridge,
> +				 pl->bridge.next_bridge, bridge,
>  				 DRM_BRIDGE_ATTACH_NO_CONNECTOR);
>  }
>  
> @@ -260,7 +259,7 @@ static int imx8qxp_pixel_link_find_next_bridge(struct imx8qxp_pixel_link *pl)
>  {
>  	struct device_node *np = pl->dev->of_node;
>  	struct device_node *port;
> -	struct drm_bridge *selected_bridge = NULL;
> +	struct drm_bridge *selected_bridge __free(drm_bridge_put) = NULL;
>  	u32 port_id;
>  	bool found_port = false;
>  	int reg;
> @@ -297,7 +296,8 @@ static int imx8qxp_pixel_link_find_next_bridge(struct imx8qxp_pixel_link *pl)
>  			continue;
>  		}
>  
> -		struct drm_bridge *next_bridge = of_drm_find_bridge(remote);
> +		struct drm_bridge *next_bridge __free(drm_bridge_put) =
> +			of_drm_find_and_get_bridge(remote);
>  		if (!next_bridge)
>  			return -EPROBE_DEFER;
>  
> @@ -305,12 +305,14 @@ static int imx8qxp_pixel_link_find_next_bridge(struct imx8qxp_pixel_link *pl)
>  		 * Select the next bridge with companion PXL2DPI if
>  		 * present, otherwise default to the first bridge
>  		 */
> -		if (!selected_bridge || of_property_present(remote, "fsl,companion-pxl2dpi"))
> -			selected_bridge = next_bridge;
> +		if (!selected_bridge || of_property_present(remote, "fsl,companion-pxl2dpi")) {
> +			drm_bridge_put(selected_bridge);
> +			selected_bridge = drm_bridge_get(next_bridge);

Considering selecting the first bridge without the companion pxl2dpi,
there would be a superfluous refcount for the selected bridge:

1) of_drm_find_and_get_bridge: refcount = 1
2) drm_bridge_put: noop, since selected_bridge is NULL, refcount = 1
3) drm_bridge_get: refcount = 2
4) drm_bridge_put(__free): refcount = 1
5) drm_bridge_get: for the pl->bridge.next_bridge, refcount = 2

I think the below snippet would be the right thing to do:
-8<-
{
	...

	struct drm_bridge *next_bridge __free(drm_bridge_put) =
		of_drm_find_and_get_bridge(remote);
  		if (!next_bridge)
  			return -EPROBE_DEFER;

	/*
	 * Select the next bridge with companion PXL2DPI if
	 * present, otherwise default to the first bridge
	 */
	if (!selected_bridge)
		selected_bridge = drm_bridge_get(next_bridge);

	if (of_property_present(remote, "fsl,companion-pxl2dpi")) {
		if (selected_bridge)
			drm_bridge_put(selected_bridge);

		selected_bridge = drm_bridge_get(next_bridge);
	}
}

...
pl->bridge.next_bridge = selected_bridge;
-8<-

Make sense?

> +		}
>  	}
>  
>  	pl->mst_addr = port_id - 1;
> -	pl->next_bridge = selected_bridge;
> +	pl->bridge.next_bridge = drm_bridge_get(selected_bridge);
>  
>  	return 0;
>  }
> 

-- 
Regards,
Liu Ying